Should delete session before inserting

[HosMercury]

I have a React app
if I logged in as [email protected] .. I got the cookie of the session and everything is ok ..

while If I log in with OAuth user .. here there is a new user .. while saving the new user into the session

        session
            .insert(USER_SESSION_KEY, user)
            .await
            .expect("Saving user in session failed");

This does not regenerate the session key for the new use .. that means or could be a bug ..

So I had to do this :

    pub async fn save_session_user(user: User, session: &Session) {
       session.delete().await.unwrap();
       session
           .insert(USER_SESSION_KEY, user)
           .await
           .expect("Saving user in session failed");
   }

To regenerate the session?

wdyt?

[maxcountryman]

You shouldn't need to manually delete the session. Calling login will regenerate the session ID so make sure you're doing that. Also logout will flush the session so if you do want to delete the session it's usually better to do it that way.

[HosMercury]

Max trying to add twice to the same key does not change the sessionID / cookie

so from react, I tried to sign in with another user , the cookie does not change and react showed the previous user which could potentially be a bug

[maxcountryman]

As I said, you should generally be using logout (assuming you're using axum-login).

Either way, if a session cookie already exists then this is expected behavior and so that's why it's important to use logout.

[HosMercury]

i did it the way i feel more secure